I know this is probably going to sound incredibly stupid as I am incredibly stupid but I was just wondering.
What's stopping people from turning a flashcard into a .cia and just running it through pastaCFW? How is it different to a gamecartridge and a game .cia?
Sorry if this is the wrong place to ask.
I don't know the details of 3DS development, so I can't say for certain, so this post is going to be mostly conjecture.
If you mean a DS card, I think there are problems writing code to run in DS mode. I know Gateway does something to TWL_FIRM that causes DS flash cards to not work, not to mention there might be issues emulating the hardware of a flash card that allows it to access a filesystem for the microSD card.
If you mean a 3DS card, I think that eventually, there will be a "loader" app that will load .3ds roms off the system SD card, but I think there is missing pieces of access currently. I'm not sure how much of the system we have control over, even when running a CFW. There could be something missing that prevents us from being able to read and transfer control to an executable on the SD card, as well, such as the need for a translation/redirection layer.
A game CIA is installed onto the SD card and is unpacked. A card CIA would have to deal with .3ds files, redirecting reads and writes to that file instead of the memory addresses associated with the card slot, as well as possibly convert filesystem requests. The layer of emulation required would probably be minor, but there could either be performance issues or security issues blocking that currently.
Anyway, like I said, I haven't explored that area of knowledge yet, so I don't know how accurate these are. It would be nice if someone more knowledgeable posts, though.